@nanhara/hara 0.123.0 → 0.124.0

package/dist/config.js

@@ -1,9 +1,8 @@
-import { randomUUID } from "node:crypto";
 import { homedir } from "node:os";
 import { join, dirname, resolve } from "node:path";
-import { closeSync, constants, existsSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, realpathSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { existsSync, lstatSync, realpathSync } from "node:fs";
 import { agentMaxRounds, agentRunTimeoutMs } from "./agent/limits.js";
-import { ensurePrivateHaraState } from "./security/private-state.js";
+import { bindPrivateHaraStateFile, ensurePrivateHaraState, readPrivateStateFileSnapshotSync, writePrivateStateFileSync, } from "./security/private-state.js";
 import { readVerifiedRegularFileSnapshotSync } from "./fs-read.js";
 import { projectRepositoryTrustedAtStartup } from "./security/project-trust.js";
 import { isHomeWorkspace } from "./context/workspace-scope.js";
@@ -109,15 +108,11 @@ function configRecord(value) {
 }
 export function readRawConfig() {
     ensurePrivateHaraState();
-    const p = configPath();
-    if (!existsSync(p))
-        return {};
     try {
-        const snapshot = readVerifiedRegularFileSnapshotSync(p, MAX_GLOBAL_CONFIG_BYTES, {
-            action: "read global config",
-            protectSensitive: false,
-            rejectHardLinks: true,
-        });
+        const binding = bindPrivateHaraStateFile(homedir(), [], "config.json");
+        const snapshot = readPrivateStateFileSnapshotSync(binding.path, MAX_GLOBAL_CONFIG_BYTES);
+        if (!snapshot)
+            return {};
         return configRecord(JSON.parse(snapshot.text));
     }
     catch {
@@ -239,91 +234,33 @@ function readProjectConfig(cwd) {
     }
     return {};
 }
-function existingConfigIdentity(path) {
-    try {
-        const info = lstatSync(path);
-        if (info.isSymbolicLink())
-            throw new Error(`refusing global config write: '${path}' is a symbolic link`);
-        if (!info.isFile())
-            throw new Error(`refusing global config write: '${path}' is not a regular file`);
-        if (info.nlink !== 1)
-            throw new Error(`refusing global config write: '${path}' is hard-linked`);
-        return { dev: info.dev, ino: info.ino };
-    }
-    catch (error) {
-        if (error?.code === "ENOENT")
-            return null;
-        throw error;
-    }
-}
-/** Atomically replace the global 0600 config without opening its current directory entry for write. */
-function persistConfig(p, cfg) {
+/** Atomically replace the global 0600 config through the shared private-state CAS boundary. */
+function persistConfig(cfg) {
     ensurePrivateHaraState();
-    const parent = dirname(p);
-    mkdirSync(parent, { recursive: true, mode: 0o700 });
-    const parentInfo = lstatSync(parent);
-    const canonicalParent = realpathSync.native(parent);
-    if (!parentInfo.isDirectory() || parentInfo.isSymbolicLink()) {
-        throw new Error(`refusing global config write: '${parent}' is not a canonical directory`);
-    }
-    const existing = existingConfigIdentity(p);
-    const temp = join(parent, `.config-${process.pid}-${randomUUID()}.tmp`);
-    const noFollow = typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0;
-    let fd;
-    try {
-        fd = openSync(temp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | noFollow, 0o600);
-        writeFileSync(fd, JSON.stringify(cfg, null, 2) + "\n", "utf8");
-        fsyncSync(fd);
-        const staged = fstatSync(fd);
-        if (!staged.isFile() || staged.nlink !== 1)
-            throw new Error("refusing global config write: unsafe staging inode");
-        closeSync(fd);
-        fd = undefined;
-        const parentAfter = lstatSync(parent);
-        if (!parentAfter.isDirectory() || parentAfter.isSymbolicLink() ||
-            parentAfter.dev !== parentInfo.dev || parentAfter.ino !== parentInfo.ino ||
-            realpathSync.native(parent) !== canonicalParent)
-            throw new Error(`refusing global config write: '${parent}' changed before commit`);
-        const current = existingConfigIdentity(p);
-        if ((existing === null) !== (current === null) || (existing && current && (existing.dev !== current.dev || existing.ino !== current.ino))) {
-            throw new Error(`refusing global config write: '${p}' changed before commit`);
-        }
-        // rename replaces the path entry; it never follows an alias planted after the last identity check.
-        renameSync(temp, p);
-        const committed = lstatSync(p);
-        if (!committed.isFile() || committed.isSymbolicLink() || committed.dev !== staged.dev || committed.ino !== staged.ino || committed.nlink !== 1) {
-            throw new Error(`global config changed during commit: '${p}'`);
-        }
-    }
-    finally {
-        if (fd !== undefined)
-            try {
-                closeSync(fd);
-            }
-            catch { /* preserve original error */ }
-        try {
-            rmSync(temp, { force: true });
-        }
-        catch { /* preserve original error */ }
-    }
+    const binding = bindPrivateHaraStateFile(homedir(), [], "config.json");
+    writePrivateStateFileSync(binding, JSON.stringify(cfg, null, 2) + "\n");
+}
+/** Mutate global config without exposing a second direct-write implementation to feature modules. */
+export function updateRawConfig(mutate) {
+    const config = readRawConfig();
+    const replacement = mutate(config);
+    persistConfig(replacement ?? config);
 }
 export function writeConfigValue(key, value) {
-    const p = configPath();
-    const cfg = readRawConfig();
-    cfg[key] = value;
-    persistConfig(p, cfg);
+    updateRawConfig((config) => {
+        config[key] = value;
+    });
 }
 /** Record (or clear, with cap=null) a confirmed per-model vision capability in `modelVision`. */
 export function setModelVisionOverride(model, cap) {
-    const p = configPath();
-    const cfg = readRawConfig();
-    const map = cfg.modelVision && typeof cfg.modelVision === "object" ? cfg.modelVision : {};
-    if (cap === null)
-        delete map[model];
-    else
-        map[model] = cap;
-    cfg.modelVision = map;
-    persistConfig(p, cfg);
+    updateRawConfig((config) => {
+        const map = config.modelVision && typeof config.modelVision === "object" ? config.modelVision : {};
+        if (cap === null)
+            delete map[model];
+        else
+            map[model] = cap;
+        config.modelVision = map;
+    });
 }
 /**
  * Effective config. Precedence (high→low): env vars > allowed/trusted project `.hara/config.json` >

package/dist/desk.js

@@ -4,13 +4,15 @@
 //
 // Credentials live in ~/.hara/desk.json (0600): the desk URL + this agent's token, written once at
 // `hara desk register`. Every later call reads them back. The token is a bearer secret — never logged.
-import { readFileSync, writeFileSync, mkdirSync, chmodSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
-const credsPath = () => join(homedir(), ".hara", "desk.json");
+import { bindPrivateHaraStateFile, readPrivateStateFileSnapshotSync, writePrivateStateFileSync, } from "./security/private-state.js";
 export function loadCreds() {
     try {
-        const c = JSON.parse(readFileSync(credsPath(), "utf8"));
+        const binding = bindPrivateHaraStateFile(homedir(), [], "desk.json");
+        const snapshot = readPrivateStateFileSnapshotSync(binding.path, 1024 * 1024);
+        if (!snapshot)
+            return null;
+        const c = JSON.parse(snapshot.text);
         return c.url && c.token ? c : null;
     }
     catch {
@@ -18,16 +20,8 @@ export function loadCreds() {
     }
 }
 export function saveCreds(c) {
-    const dir = join(homedir(), ".hara");
-    mkdirSync(dir, { recursive: true });
-    const p = credsPath();
-    writeFileSync(p, JSON.stringify(c, null, 2));
-    try {
-        chmodSync(p, 0o600);
-    }
-    catch {
-        /* best-effort on non-posix */
-    }
+    const binding = bindPrivateHaraStateFile(homedir(), [], "desk.json");
+    writePrivateStateFileSync(binding, JSON.stringify(c, null, 2) + "\n");
 }
 /** One HTTP call to the desk. Auth via bearer token when creds are present. Throws on non-2xx with
  *  the server's error message (so the CLI can surface a real reason, not "request failed"). */

package/dist/fs-read.js

@@ -10,6 +10,27 @@ export class BinaryFileError extends Error {
         this.name = "BinaryFileError";
     }
 }
+export class InvalidUtf8FileError extends Error {
+    code = "HARA_INVALID_UTF8";
+    constructor(path) {
+        super(`${path} is not valid UTF-8; refusing a lossy text operation. ` +
+            "Use a binary-aware tool or explicitly transcode the file first");
+        this.name = "InvalidUtf8FileError";
+    }
+}
+/** Decode a complete text-file snapshot without replacing invalid bytes or dropping a UTF-8 BOM. */
+export function decodeUtf8Strict(bytes, path) {
+    if (bytes.includes(0))
+        throw new BinaryFileError(path);
+    try {
+        // ignoreBOM=true means the BOM is emitted as U+FEFF. A later UTF-8 rewrite therefore preserves the
+        // original bytes instead of silently stripping the marker while editing otherwise valid text.
+        return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
+    }
+    catch {
+        throw new InvalidUtf8FileError(path);
+    }
+}
 export class NonRegularFileError extends Error {
     code = "HARA_NOT_REGULAR_FILE";
     constructor(path) {
@@ -44,7 +65,7 @@ export class ProtectedContextFileError extends Error {
 export class HardLinkedFileError extends Error {
     code = "HARA_HARD_LINKED_FILE";
     constructor(path) {
-        super(`${path} has multiple hard links; its protected identity cannot be established safely`);
+        super(`${path} is hard-linked (has multiple hard links); its protected identity cannot be established safely`);
         this.name = "HardLinkedFileError";
     }
 }
@@ -143,7 +164,7 @@ export async function readVerifiedRegularFileSnapshot(path, maxBytes = MAX_EDIT_
             || latest.ctimeMs !== info.ctimeMs)
             throw new Error(`refusing to read ${path}: file changed while reading it`);
         return {
-            text: Buffer.concat(chunks, total).toString("utf8"),
+            text: decodeUtf8Strict(Buffer.concat(chunks, total), path),
             dev: info.dev,
             ino: info.ino,
             mode: info.mode & 0o777,
@@ -196,7 +217,7 @@ export function readVerifiedRegularFileSnapshotSync(path, maxBytes = MAX_EDIT_RE
             || latest.ctimeMs !== info.ctimeMs)
             throw new Error(`refusing to read ${path}: file changed while reading it`);
         return {
-            text: bytes.toString("utf8"),
+            text: decodeUtf8Strict(bytes, path),
             dev: info.dev,
             ino: info.ino,
             mode: info.mode & 0o777,
@@ -278,9 +299,7 @@ export function readModelContextFileSync(path, maxBytes) {
         const bytes = readFdBytesSync(fd, Math.min(limit + 1, size + 1));
         if (bytes.length > limit)
             throw new FileReadLimitError(path, limit);
-        if (bytes.includes(0))
-            throw new BinaryFileError(path);
-        return bytes.toString("utf8");
+        return decodeUtf8Strict(bytes, path);
     });
 }
 /** Safe bounded-prefix counterpart for @file expansion; it never materializes the remainder of a huge file. */
@@ -361,7 +380,7 @@ async function readRegularFileSnapshotWithFlags(path, maxBytes, flags) {
         }
         if (total > limit)
             throw new FileReadLimitError(path, limit);
-        return { text: Buffer.concat(chunks, total).toString("utf8"), dev: info.dev, ino: info.ino, mode: info.mode & 0o777, nlink: info.nlink };
+        return { text: decodeUtf8Strict(Buffer.concat(chunks, total), path), dev: info.dev, ino: info.ino, mode: info.mode & 0o777, nlink: info.nlink };
     }
     finally {
         await handle.close().catch(() => { });

package/dist/gateway/weixin.js

@@ -4,11 +4,10 @@
 // `qrcode-terminal` dep (graceful fallback to printing the URL). No encryption is needed on the text path
 // (iLink only uses crypto for media upload/download, which v1 doesn't do).
 import { homedir } from "node:os";
-import { join } from "node:path";
-import { chmodSync, readFileSync, writeFileSync, existsSync, mkdirSync, renameSync, rmSync } from "node:fs";
 import { randomBytes, randomUUID, createHash, createCipheriv, createDecipheriv } from "node:crypto";
 import { chunkText } from "./telegram.js";
 import { INBOUND_MEDIA_MAX_BYTES, INBOUND_MEDIA_TIMEOUT_MS, InboundMediaBudget, cleanupTransientMedia, readResponseBytesLimited, savePrivateMediaBytes, } from "./media.js";
+import { bindPrivateHaraStateFile, readPrivateStateFileSnapshotSync, writePrivateStateFileSync, } from "../security/private-state.js";
 const ILINK_BASE_URL = "https://ilinkai.weixin.qq.com";
 const CHANNEL_VERSION = "2.2.0";
 const ILINK_APP_ID = "bot";
@@ -186,33 +185,53 @@ async function apiGet(baseUrl, endpoint, timeoutMs) {
         throw new Error(`iLink GET ${endpoint} HTTP ${res.status}: ${raw.slice(0, 200)}`);
     return JSON.parse(raw);
 }
-const weixinDir = () => join(homedir(), ".hara", "weixin");
-const credsFile = () => join(weixinDir(), "creds.json");
-export function loadWeixinCreds() {
+function weixinStateFile(filename) {
+    return bindPrivateHaraStateFile(homedir(), ["weixin"], filename);
+}
+function accountStateFilename(accountId, suffix) {
+    const normalized = String(accountId ?? "").trim();
+    const key = /^[A-Za-z0-9_-]{1,128}$/.test(normalized)
+        ? normalized
+        : `account-${createHash("sha256").update(normalized).digest("hex")}`;
+    return `${key}${suffix}`;
+}
+/** Return peer identifiers without exposing token values or bypassing the private-state reader. */
+export function weixinKnownPeers(accountId) {
     try {
-        return existsSync(credsFile()) ? JSON.parse(readFileSync(credsFile(), "utf8")) : null;
+        const binding = weixinStateFile(accountStateFilename(accountId, ".context-tokens.json"));
+        const snapshot = readPrivateStateFileSnapshotSync(binding.path, 8 * 1024 * 1024);
+        if (!snapshot)
+            return [];
+        const parsed = JSON.parse(snapshot.text);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return [];
+        return Object.entries(parsed)
+            .slice(-1000)
+            .filter(([peer, token]) => Boolean(peer) && typeof token === "string" && Boolean(token))
+            .map(([peer]) => peer);
     }
     catch {
-        return null;
+        return [];
     }
 }
-function saveWeixinCreds(c) {
-    mkdirSync(weixinDir(), { recursive: true, mode: 0o700 });
+export function loadWeixinCreds() {
     try {
-        chmodSync(weixinDir(), 0o700);
+        const binding = weixinStateFile("creds.json");
+        const snapshot = readPrivateStateFileSnapshotSync(binding.path, 1024 * 1024);
+        return snapshot ? JSON.parse(snapshot.text) : null;
     }
-    catch { /* best effort */ }
-    writeFileSync(credsFile(), JSON.stringify(c, null, 2), { mode: 0o600 });
-    try {
-        chmodSync(credsFile(), 0o600);
+    catch {
+        return null;
     }
-    catch { /* best effort */ }
+}
+function saveWeixinCreds(c) {
+    writePrivateStateFileSync(weixinStateFile("creds.json"), JSON.stringify(c, null, 2) + "\n");
 }
 // get_updates_buf cursor — persisted so a restart resumes the message stream where it left off.
 function loadCursor(accountId) {
     try {
-        const f = join(weixinDir(), `${accountId}.cursor`);
-        return existsSync(f) ? readFileSync(f, "utf8") : "";
+        const binding = weixinStateFile(accountStateFilename(accountId, ".cursor"));
+        return readPrivateStateFileSnapshotSync(binding.path, 4 * 1024 * 1024)?.text ?? "";
     }
     catch {
         return "";
@@ -220,11 +239,8 @@ function loadCursor(accountId) {
 }
 function saveCursor(accountId, buf) {
     try {
-        mkdirSync(weixinDir(), { recursive: true, mode: 0o700 });
-        chmodSync(weixinDir(), 0o700);
-        const file = join(weixinDir(), `${accountId}.cursor`);
-        writeFileSync(file, buf, { mode: 0o600 });
-        chmodSync(file, 0o600);
+        const binding = weixinStateFile(accountStateFilename(accountId, ".cursor"));
+        writePrivateStateFileSync(binding, buf);
     }
     catch {
         /* best-effort */
@@ -237,10 +253,9 @@ class TokenStore {
     constructor(accountId) {
         this.accountId = accountId;
         try {
-            const exists = existsSync(this.file());
-            const parsed = exists ? JSON.parse(readFileSync(this.file(), "utf8")) : {};
-            if (exists)
-                chmodSync(this.file(), 0o600);
+            const binding = this.binding();
+            const snapshot = readPrivateStateFileSnapshotSync(binding.path, 8 * 1024 * 1024);
+            const parsed = snapshot ? JSON.parse(snapshot.text) : {};
             if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
                 for (const [peer, token] of Object.entries(parsed).slice(-1000)) {
                     if (peer && typeof token === "string" && token)
@@ -252,32 +267,19 @@ class TokenStore {
             this.cache.clear();
         }
     }
-    file() {
-        return join(weixinDir(), `${this.accountId}.context-tokens.json`);
+    binding() {
+        return weixinStateFile(accountStateFilename(this.accountId, ".context-tokens.json"));
     }
     peerKey(peer) {
         return String(peer ?? "").trim().slice(0, 256);
     }
     persist() {
-        const temporary = `${this.file()}.${process.pid}.${randomUUID()}.tmp`;
         try {
-            mkdirSync(weixinDir(), { recursive: true, mode: 0o700 });
-            chmodSync(weixinDir(), 0o700);
-            writeFileSync(temporary, JSON.stringify(Object.fromEntries(this.cache)), { mode: 0o600, flag: "wx" });
-            renameSync(temporary, this.file());
-            chmodSync(this.file(), 0o600);
+            writePrivateStateFileSync(this.binding(), JSON.stringify(Object.fromEntries(this.cache)) + "\n");
         }
         catch {
             /* best-effort */
         }
-        finally {
-            try {
-                rmSync(temporary, { force: true });
-            }
-            catch {
-                /* best-effort */
-            }
-        }
     }
     get(peer) {
         const key = this.peerKey(peer);